Pulp-style warning robot with a red beacon pointing at a cracked padlock

Node2Shell (CVE-2026-111497): patch Node.js, .NET and anything else that decodes Brotli

ALERT · Patch available. Not known exploited. Last updated 27 October 2026. See the Alert Tracker

If any of your services decompress Brotli data that someone else sent them, update the runtime and restart it this week. CVE-2026-111497, nicknamed Node2Shell, is an out-of-bounds write in Google’s Brotli decoder. Node.js fixed it on 21 October and Microsoft fixed .NET and PowerShell on 25 October. Nobody has reported attacks, but one security firm has shown code execution against an official Node.js build.

What it is

Brotli is a compression format used widely on the web, and Google’s decoder library is built into a long list of runtimes and tools. A malformed Brotli stream can make the decoder in versions 1.0.3 to 1.2.0 write past the end of an internal buffer. Google, the CVE Numbering Authority (CNA), fixed it in Brotli 1.0.10, 1.1.1 and 1.2.1 (opens in a new tab). Node.js credits Khai Tran and Sylvie Mayer of OpenAI’s Codex Security team with the report; Envoy and Istio credit OpenAI Security Research.

The Node.js security release (opens in a new tab) says: “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.”

The condition that matters is that your software decodes Brotli data an attacker controls. That can be a compressed request body, a compressed response fetched from a server you do not trust, or a compressed file. Using Brotli only to compress what you send out does not, by itself, expose you.

Scores

  • CNA (Google): CVSS 4.0 9.2, Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). NVD (opens in a new tab) shows this score and has not published its own; its status is “Awaiting Analysis”.
  • Node.js: rates the issue High.
  • Microsoft: CVSS 3.1 8.1, High, with attack complexity High. Microsoft rates it Critical for .NET and Visual Studio and Important for PowerShell, and assesses exploitation as “More Likely”.
  • Ubuntu: Medium priority.
  • CISA SSVC (as shown on NVD, 23 October): exploitation none, automatable no, technical impact total.

Is it being exploited?

Not as far as anyone has said. CVE-2026-111497 is not in CISA’s Known Exploited Vulnerabilities catalogue (opens in a new tab) (version 2026.10.23), and none of the vendors we checked reports attacks. Microsoft’s advisory marks it as publicly disclosed but not exploited.

Imperva (opens in a new tab) reports code execution against the official Node.js 24.22.0 image for Linux on arm64, using Brotli data in a response read by Node’s built-in fetch() and in request bodies parsed by Express 5 and body-parser 2. It says the proof “did not succeed on every attempt”, and it did not test every Node.js build or application. The same inputs were rejected by 24.22.1. SecurityWeek (opens in a new tab) reports that Imperva has not made its exploit public.

SecurityWeek reports (opens in a new tab) that some researchers argue the bug can in practice only crash a process, and that the first public proof of concept achieved code execution only against a deliberately weakened build. Public proofs of concept on GitHub do crash unpatched Node.js 20, 22, 24 and 26 services over the network. A crash is still a denial of service against anything internet-facing, and Imperva’s result shows code execution is possible on at least one official build. We would patch on that basis rather than wait for the argument to settle. Treat “Node2Shell” exploit or scanner code from unknown sources with caution.

Who is affected

  • Node.js applications that decompress untrusted Brotli through node:zlib. That includes Express 5 and body-parser 2, which decode Content-Encoding: br request bodies, and the built-in fetch(), which decodes Brotli responses automatically. A bare Node.js HTTP server does not decode request bodies just by receiving them. The 22.x, 24.x and 26.x lines are affected. End-of-life lines, including 20.x and older, are affected and get no fix: Node.js says end-of-life versions are always affected when a security release occurs. Node.js packaged by Linux distributions uses the system Brotli library instead; see the fixed versions below.

Ubuntu: USN-8956-1 (opens in a new tab) (26 Oct 2026) fixes the system Brotli packages (brotli and libbrotli1) in 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1). On those releases Node.js uses the system Brotli, so the same update covers it. Still unfixed: brotli on 20.04, 18.04 and 16.04 is “needs evaluation”, and Node.js on 20.04, which bundles its own Brotli, is marked vulnerable on Ubuntu’s CVE page (opens in a new tab). Node.js on 18.04 and earlier doesn’t use Brotli. Checked 27 Oct 2026.

  • Python packages brotli and brotlicffi, which ship their own copy of the decoder in their PyPI wheels; distribution packages such as Debian’s python3-brotlicffi use the system library, so update that instead.
  • .NET 8, 9, 10 and the .NET 11 previews, plus PowerShell 7.4 to 7.6 and Visual Studio 2019, 2022 and 2026. .NET Framework is not affected. Microsoft says ASP.NET Core request decompression and HttpClient automatic decompression are off by default, so an app is exposed only if it turns on Brotli request decompression, sets AutomaticDecompression to Brotli or All, or runs BrotliStream or BrotliDecoder over data it does not control.
  • Envoy Proxy and Istio, only where the Brotli decompressor filter is configured (in Istio, usually through an EnvoyFilter).
  • Bun, which bundles the decoder.
  • Everything else that bundles Brotli. Browsers, Electron desktop apps, language bindings, database engines, proxy modules and file tools carry their own copies. Many projects are still working through it. Check your vendors rather than assuming a system library update covers them.

Fixed versions

  • Node.js (official builds): 22.23.4, 24.22.1 and 26.12.1. Move anything on 20.x or older to a supported line. Distribution-packaged Node.js is fixed through the system Brotli library (next item).
  • Python: brotli 1.2.1 and brotlicffi 1.2.1.0 (GHSA-9v8h-qqgm-4m35 (opens in a new tab)).
  • .NET runtime: 8.0.33, 9.0.22 and 10.0.14 (SDKs 8.0.133 or 8.0.427, 9.0.123 or 9.0.320, 10.0.114 or 10.0.403), and 11.0.0-rc.3 (SDK 11.0.100-rc.3.26522.148) for the preview (.NET announcement (opens in a new tab)).
  • PowerShell: 7.4.22, 7.5.13 and 7.6.9. Visual Studio: 2019 16.11.61, 2022 17.14.43 and 2026 18.11.2 (Microsoft (opens in a new tab)).
  • Envoy: Envoy fixed 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12 (GHSA-3wvj-j6qm-62mr (opens in a new tab)).
  • Istio: 1.31.2, 1.30.6 and 1.29.9 (ISTIO-SECURITY-2026-007 (opens in a new tab)). 1.29 is end of life.
  • Bun: update to 1.4.4, which bundles Brotli 1.2.1 (Bun blog (opens in a new tab)).
  • Linux distributions: update the system Brotli library packages (libbrotli1 on Debian and Ubuntu) as your distribution releases them, then restart services that use them, including distribution-packaged Node.js and Python, which link the system library. See Debian’s (opens in a new tab) and Ubuntu’s (opens in a new tab) trackers. Debian has fixed brotli in 1.0.9-2+deb12u1 for bookworm (DLA-4855-1), 1.1.0-2+deb13u1 for trixie (DSA-6582-1) and 1.2.0-4.1 in sid. Ubuntu published fixed brotli packages for 22.04 LTS and later on 26 October (USN-8956-1); 20.04 and older are still unfixed.

Updating is not enough on its own. Restart every service, worker and scheduled job, and rebuild container images on a patched base. Microsoft says self-contained .NET apps must be rebuilt and NativeAOT apps republished, because updating the shared runtime does not replace a decoder already compiled into the executable.

How to find it in your estate

This is mostly an inventory job. Do not test production services with malformed Brotli data.

  • Node.js versions. Run node -v on hosts and in every image, or pull the runtime version from your container registry scanner or EDR inventory. For official Node.js builds (nodejs.org, the official Docker images, nvm and similar), anything below 22.23.4, 24.22.1 or 26.12.1 on its line, or on 20.x or older, is unpatched. Node.js packaged by Linux distributions is different: Debian, and Ubuntu 22.04 and later, build it against the system Brotli library, so the fix is the distribution’s brotli package, followed by a restart of every Node.js process. Debian has fixed it (1.0.9-2+deb12u1 for bookworm, 1.1.0-2+deb13u1 for trixie); Ubuntu has fixed 22.04 LTS and later, but on Ubuntu 20.04 Node.js carries its own copy of Brotli and is still marked vulnerable (see above). On those builds neither the Node.js version nor process.versions.brotli tells you whether you are patched; check the installed brotli package version instead.
  • Node.js code paths. In each application, npm ls express body-parser shows whether Express 5 or body-parser 2 is present. Search the code for zlib.brotliDecompress, createBrotliDecompress and server-side fetch() calls to third-party URLs.
  • Bun. bun --version below 1.4.4.
  • Python. pip show brotli brotlicffi in each environment, or pip list --format=freeze fed to your dependency scanner. Remember virtual environments and containers, not just the system Python.
  • .NET and PowerShell. dotnet --list-runtimes and pwsh -v. Search code and configuration for AddRequestDecompression, AutomaticDecompression, BrotliStream and BrotliDecoder to find the apps that are actually exposed. List self-contained and NativeAOT apps separately, because they need a rebuild.
  • Proxies. Search Envoy configuration and Istio EnvoyFilter resources for a decompressor whose library is the Brotli type.
  • SBOMs and dependency scanners. Search your SBOMs for Brotli and for the products above, and check that your scanners have picked up CVE-2026-111497. Bundled copies inside other software will often not show up as a separate component.

What to do

  • Patch internet-facing Node.js services first, especially those running Express 5 or body-parser 2, and anything that fetches content from third parties on the server. Then Envoy and Istio gateways with Brotli decompression, then .NET apps that enable it, then everything else.
  • Restart and verify. Check that the running process or image, not just the package on disk, is the fixed version.
  • If you cannot patch at once, stop decoding Brotli you did not produce. Microsoft’s interim advice for .NET is to stop decompressing attacker-controlled Brotli data: remove the Brotli provider from existing request-decompression configuration and do not add new decompression. Envoy and Istio are exposed only where the Brotli decompressor is configured. For everything else, the reporters’ disclosure site, OpenAI’s Patch the Planet (opens in a new tab), recommends rejecting requests with Content-Encoding: br before any proxy, middleware or body parser decodes them, turning off automatic Brotli decoding in HTTP clients, and removing Brotli decompressor filters in Envoy and Istio while keeping separate gzip and zstd filters. It says a WAF is not a complete substitute: any block has to cover direct-to-origin and alternate routes, and downstream decoders need protecting too. Removing br from Accept-Encoding does not stop a server sending it anyway.
  • Size caps are not a fix. In our view, capping decompressed sizes is still good hygiene against decompression bombs, but this bug is triggered by malformed data, not volume, so a cap will not stop it. Treat request-size limits and WAF rules as a stopgap that covers only the paths they sit in front of.
  • Watch your Node.js processes. Unexpected Node.js crashes on internet-facing services, especially just after requests carrying Content-Encoding: br, and a Node.js or Bun server process starting a shell, PowerShell or a download tool, both deserve a look. This is our suggestion, not vendor guidance.

Our Hunt Lab folder for CVE-2026-111497 (opens in a new tab) has a Sigma rule for Node.js or Bun server processes spawning shells, plus hunting notes for crashes and Brotli request bodies. No indicators of compromise have been published.

Sources

Correction, 26 October 2026: added Ubuntu status and the 20.04 exception.

Updated 27 October 2026: Ubuntu has released fixes; we have updated the Ubuntu line.

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)